What is the total cost of POTRAZ data protection compliance for a small business?
Short answer
For a Tier 1 business with an internal Data Protection Officer, roughly USD 1,300 to USD 2,000 in the first year: the POTRAZ licence (USD 50), the DPO certification (USD 1,250), a staff awareness session and basic security you should have anyway. In later years the licence (USD 50), CPD for the DPO and any software subscription.
What the law says
The mandatory costs are fixed in SI 155's Second Schedule: the tier licence fee (USD 50 for Tier 1, USD 300 plus USD 30 for Tier 2) and the DPO certification (USD 1,250 for citizens). Section 10 of SI 155 adds an annual CPD expectation for the DPO. The other costs are how you meet the general duties: section 18 security (password manager, two-factor authentication, backups, device encryption, all cheap or free), sections 15 and 16 (a privacy notice you write once) and section 16 of SI 155 (policies and training).
Example
A Tier 1 guest house in Nyanga with 12 staff and 700 past guests: licence USD 50; the manager's DPO certification USD 1,250; two nights' accommodation in Harare for the course; a company phone for WhatsApp Business USD 120; a password manager subscription USD 40; one hour of staff time for the awareness session; templates from our training package. About USD 1,500 in year one, USD 50 plus CPD thereafter. The same guest house with an external shared DPO: USD 50 plus a modest annual retainer, no certification fee.
In practice
Budget the certification as the main first-year item and the licence as a recurring line. If you are Tier 2, add USD 280 a year for the licence. Compare the total with one month of a junior salary, or with the cost of a single badly handled breach.
General information, not legal advice. This page covers Zimbabwean law only: the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and POTRAZ’s 2025 Implementation Guidelines. It is not the EU GDPR and not South Africa’s POPIA. Fees, fine levels and deadlines are as gazetted and published by POTRAZ at 9 September 2026; check the latest POTRAZ notices before acting. Businesses named in examples are fictional.